Build Logs & Industry Playbooks

Cookie Consent and Analytics for a UK Business Website

By Mudabbir Hasan, Co-founder · Published · Last updated

Under the ICO's guidance, a UK site needs consent before setting non-exempt cookies, and refusing must be as easy as accepting. Analytics may fall under a narrow statistical exception, but only if it is used for nothing else, users are told clearly, they can object easily and the data is aggregated. The safe pattern is to load analytics only after opt-in and to record the choice.

Why does a business website need a consent banner?

In the UK, storing or reading information on a visitor's device, which includes most cookies, needs consent unless an exception applies. The ICO's guidance on storage and access technologies sets out the exceptions and what a valid consent mechanism looks like. This article summarises that guidance for a business owner. It is general information, not legal advice, so check your own set-up with a data protection adviser.

When might analytics not need consent?

The ICO describes a statistical purposes exception, which it also calls the analytics exception. It applies only when the sole purpose of the storage or access is to gather statistics about how your service is used, in order to improve it. The conditions are strict:

  • Sole purpose. If the same data is also used for anything else, such as advertising, the exception no longer applies and you need consent.
  • Clear and comprehensive information about the purpose, including telling users when a third-party analytics provider is involved and what it does with the data.
  • A simple, free means of objecting. If someone objects you must stop, and you can resume if they later opt back in.
  • Aggregated data, with individual-level data kept no longer than the aggregation needs, and a third-party provider acting as a processor and using the data only to help improve your service.

The ICO's examples of what can qualify include page-by-page visit totals, scroll depth, device and browser types, referrers, A/B testing, coarse location and load speed. What does not qualify is tracking or profiling individuals, advertising measurement and cross-service monitoring. Whether a particular analytics set-up meets every condition is a judgement for you and your adviser. A simpler route is to ask for consent for all analytics.

What makes consent valid?

Where you do need consent, the ICO's expectations for the mechanism are specific:

  • Refusing must be as easy as accepting. The ICO's checklist item is that the mechanism makes it as easy to refuse consent as it is to accept. A banner with an "Accept all" button and only a "more options" link is its example of bad practice.
  • Consent needs a positive action before the technologies are set. Continuing to browse is not consent, and toggles for non-exempt purposes should default to off.
  • Withdrawing must be as easy as giving consent, and users should be shown how to revisit their choice, for example through a persistent settings link.
  • You must be able to demonstrate that someone gave consent, so record the choice and protect the record.

Banner check

Not valid

  • Only 'Accept all' plus a 'more options' link
  • Non-exempt toggles on by default
  • Continuing to browse counts as consent

Valid

  • Accepting and refusing are equally easy
  • A positive action before anything is set
  • Withdrawing is as easy as giving
  • The choice is recorded
Source: ICO guidance.

Where does Google consent mode fit?

Google's consent mode lets your tags know what the visitor chose. It uses four signals, each set to granted or denied: ad_storage, analytics_storage, ad_user_data and ad_personalization. The last two were added in the November 2023 update. By default no values are set, so you must set a default for each one before any tag runs, then send an update when the visitor makes a choice. Google notes that consent mode does not save the choice, so you must store it yourself and send the update again on later pages. Order matters: if the consent code runs out of order, the defaults will not work.

In Google Tag Manager, Google recommends loading your own banner through a consent mode template, and warns against replacing the template's update call with a plain gtag consent update, because gtag commands are queued behind other messages and may be processed too late.

Consent mode, in order

  1. 1

    Defaults set to denied

    Before any tag runs.

  2. 2

    The banner is shown

  3. 3

    The visitor chooses

  4. 4

    An update sends the choice

    analytics_storage, ad_storage and the rest.

  5. 5

    Tags run only if granted

  6. 6

    The choice is stored and can be changed

How does our own site handle it?

Everything is denied for every visitor until they choose, with no regional exceptions. The banner's "Reject all" and "Accept all" buttons use the same style and size on purpose. Google Tag Manager is not loaded at all until the visitor opts in, so a visitor who declines or has not yet chosen triggers no request to it. One stored choice gates the tag loader, event tracking and first-touch attribution, and the cookie settings page lets people change their mind. The choice is mapped to Google's consent mode signals.

That is deliberately conservative. We ask for consent for analytics instead of relying on the statistical exception, which keeps the rules simple.

Website design and development services

What should you check on your own site?

  • Open the site in a private window and look at the network requests before you click anything. Analytics and advertising requests should not appear.
  • Compare the sizes and prominence of the accept and reject buttons.
  • Check that you can change or withdraw the choice later, and that withdrawal stops the tags.
  • Confirm your consent mode defaults run before any tag and that updates are sent on every page.
  • Keep a record of the consent choice and decide how long it lasts.

Test your own site

  • No analytics requests before you click

  • Accept and reject buttons the same size

  • You can change the choice later

  • Consent defaults run before any tag

  • The choice is recorded

Sources

Related guides

Talk to an engineer about your project

Start with a free project call. We learn what you are building and recommend the right next step, with no pitch.

Book a call